note 66377 added to features.file-upload

There was a post earlier about not using the $_FILES['userfile']['type'] for verification and that a malicious PHP file could be hidden under the image/gif mime type. That is correct, but it is not enough just to use getImageSize() or exif_imagetype() because php code can be hidden in the comment part of the picture. The only way you can be sure it will not be executed is to make sure that the extension is not recognized by the server as a php script. If you want a proof of concept, open The GIMP and create a 10x10px blank GIF image. When saving, just enter <? phpinfo() ?> as GIF comment. Rename the saved file from something.gif into the something.php and ask the server for it. (And make sure that you NEVER call include() with a file that was uploaded) ---- Server IP: 66.163.161.117 Probable Submitter: 87.116.189.139 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/features.file-upload.php Edit -- http://master.php.net/note/edit/66377 Del: integrated -- http://master.php.net/note/delete/66377/integrated Del: useless -- http://master.php.net/note/delete/66377/useless Del: bad code -- http://master.php.net/note/delete/66377/bad+code Del: spam -- http://master.php.net/note/delete/66377/spam Del: non-english -- http://master.php.net/note/delete/66377/non-english Del: in docs -- http://master.php.net/note/delete/66377/in+docs Del: other reasons-- http://master.php.net/note/delete/66377 Reject -- http://master.php.net/note/reject/66377 Search -- http://master.php.net/manage/user-notes.php